Privacy notice (draft)
Which data Podpisano processes, how long it keeps them and who processes them.
Who processes the data
Revelbit programiranje d.o.o., Jesenje 23D, 1281 Kresnice, Slovenia; registration number 7468997000, tax number 98565273 (the company is not registered for VAT). Questions: [email protected].
For the data of your account we are the controller. For the documents you upload and the signers’ data you enter, the sender is the controller and Revelbit processes the data on the sender’s behalf. This division of roles awaits legal review.
Account data
Name, e-mail address, chosen language and a hash of the password (scrypt). We do not keep the password.
For each session we keep the IP address, the browser and the times it started and was last active, until you sign out or it has been inactive for 30 days.
The account’s security log (sign-ins, password and settings changes, deleted documents) with IP address and browser is kept for 365 days.
Documents and procedures
Uploaded PDF documents are stored encrypted (AES-256-GCM) in the database, with the file name, the number and size of pages and a SHA-256 hash. The encryption key is kept apart from the database.
For each document we keep an event log (for example upload, sending, a link opened, signing, downloads) with IP address and browser; the log is protected against changes.
Signers you add (name and e-mail address) are kept with the document. When you send the document, we e-mail them an invitation with a personal link and, if you choose, reminders.
Signing
When you sign, we keep the image of your signature (drawn, typed or uploaded) encrypted, with the time of signing, IP address, browser and the consent with the version of its text. These data are written to the procedure’s log and to the certificate of completion.
We do not capture signing dynamics (speed, pressure, stroke timing): we receive only the final image. An uploaded image is redrawn by the browser; we do not receive its metadata.
If you choose “Save my signature for next time”, the image is kept encrypted with your account until you replace or delete it in the settings or delete the account.
The signed document and the certificate of completion are sealed with the electronic seal of Podpisano and kept encrypted with the document.
Signing with a certificate: the .p12 or .pfx file, its password and the private key are opened and used by your browser only; we never receive, keep or log them. We receive your certificate (the public part) and the signature. The certificate, with all personal data in it (for example name, e-mail address, a tax or other number, organisation), becomes part of the signed document and is seen by everyone who receives it. The certificate’s data (holder, issuer, serial number, validity, fingerprint), the time, IP address and browser are written to the procedure’s log and the certificate of completion. A prepared signature is kept encrypted for at most 10 minutes.
Signers without an account
For the sender we keep: the signer’s name and e-mail address as entered by the sender, the order, the chosen protection, the times of invitation, opening the link, code verification, signing or declining, the reason for declining, IP address and browser at these actions, the signature image and the consent.
Personal links and sessions are kept only as hashes; a link is valid until the signing deadline and for 30 days after completion for downloading the signed document. A signer’s session ends after 2 hours of inactivity or after 12 hours; ended sessions are deleted. Access codes are kept only as a hash (scrypt), one-time codes only as a salted hash until used or expired.
The sender sees all of this on the procedure page and in the certificate of completion. Other signers of the same document see only the signers’ names, never their e-mail addresses. A signer downloads the signed document but does not receive the certificate of completion.
Messages (address confirmation, new password, invitations, reminders, codes, notices) wait in a sending queue. Their text, which may hold a personal link, is deleted once the message is sent or has finally failed. The recipient, kind and time of a message remain for the limits against abuse and to show the sender the delivery; these records are deleted 30 days after sending or failing.
Through a link in every message to a signer, the recipient can stop further signing messages and later allow them again. We keep only a hash (SHA-256) of the address until messages are allowed again; anyone who knows the address can compute that value.
An abuse report is kept with the procedure and the sender’s account; the sender does not see it. It is deleted after 180 days. If the document is deleted earlier, only the sender’s account and the time of the report remain.
Retention and deletion
A draft is deleted automatically 90 days after its last change. A procedure that ended without completion (voided, declined or expired) is deleted 90 days after it ended. A completed document is deleted 30 days after completion. Its owner is warned by e-mail 7 days before the deletion. The date of automatic deletion is shown on the document page and in the list.
You can delete a document that is not waiting for signatures at any time; one that is waiting must be voided first. Deletion removes the document with all revisions, the signers, fields, signature images, the certificate of completion, the log, the signers’ sessions and the procedure’s messages; the signers’ links stop working. For the limits against abuse only a record of the number of messages sent, with a keyed hash (HMAC) of the address, remains for 24 hours. A signed document and certificate you have already downloaded remain verifiable by themselves.
Deleting your account deletes all your documents the same way. The rows of the security log stay until their period ends, no longer linked to the account but still with the IP address and browser of each action.
Backups of the database still contain deleted data for up to 14 days; the documents in them are encrypted, and the encryption key is not in the backup.
Visit measurement on the public pages (only with your permission)
On the home page, “How it works”, the terms, this notice and the cookies page we measure visits with Google Analytics through Google Tag Manager, but only if you allow it in the banner or on the cookies page. Until you choose, or if you decline, nothing is loaded from Google’s servers and there are no Google cookies. There is never any measurement on the sign-in and sign-up pages, the account and document pages or the signers’ pages.
Google then receives the address of the page visited without parameters, the website you came from (if you came from another page of this service that is not one of those listed, measurement does not start), the time of the visit, the language, the type of device and browser, the screen size, an approximate location that Google derives from the IP address, and a random identifier from the _ga cookie. It receives no documents, account data or signers’ data.
The recipient of the data is Google. Google Analytics sets the cookies _ga and _ga_<id>, which last 2 years by default; the sign_measure cookie keeps your choice for 6 months. Advertising purposes are declined (ad_storage, ad_user_data and ad_personalization are denied).
You can withdraw your permission at any time on the cookies page. We then delete this site’s _ga and _ga_* cookies and load the page again, so that no tag keeps running. Withdrawing does not delete data Google has already received.
Where the service runs and who else processes data
The service runs on a server that belongs to Revelbit programiranje d.o.o., in Slovenia.
Cloudflare (Cloudflare, Inc.) carries the connection between visitors and the server and can see the traffic, including documents in transit.
E-mail is sent through Proton (Proton AG, Switzerland).
Backups of the database are made every day and kept on a separate storage device at the same location. The documents in them are encrypted; the encryption key is not in the backup.
Error reports go to a self-hosted error-report server (GlitchTip), without request contents or personal data.
Google receives data about visits to the public pages (Google Analytics through Google Tag Manager), only if you allow it.
We use an analytics tool (Google Analytics) only on the public pages and only with your permission. We use no advertising tools and do not sell data.